CVE-2011-0458: Untrusted search path vulnerability in the Locate on Disk feature in Google Picasa before 3.8 allows local...

Security readout for executives and security teams

CVE-2011-0458 is a local privilege-risk issue in Google Picasa before 3.8. A local user could abuse the Locate on Disk feature by placing a malicious executable where Picasa searches first. Business urgency is mainly for environments that still allow old Picasa installations on shared or managed workstations. Exposure is likely limited to endpoints with Google Picasa versions earlier than 3.8 installed. Risk is higher on shared systems or where low-privileged users can write to directories used by the application. Treat this as a legacy endpoint hygiene issue unless Picasa remains deployed. It does not indicate internet-scale exposure, but old desktop software can still create privilege escalation paths that weaken workstation control. Mitigation focus: Inventory endpoints for Google Picasa versions earlier than 3.8.; Upgrade Picasa to 3.8 or later where still approved.; Remove Picasa where it is no longer required..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.